> ## Content Index
> Fetch the complete content index at: https://www.ostering.com/llms.txt
> Use this file to discover other available public pages before exploring further.
# Structural hazards (BKS-TR)
- URL: https://www.ostering.com/taxonomies/critical-infrastructure/bks-structural-hazards/
- Published: 2026-11-05T21:00:00.000Z
- Updated: 2026-11-05T20:44:32.694Z
- Description: Ten structural hazards that run through every essential service, each with a mitigation principle, design measures and STRIDE, CAPEC and CWE mappings.
- Author: Brett Crawley
[Taxonomies](https://ostering.com/taxonomies/) › [Critical Infrastructure](https://ostering.com/taxonomies/critical-infrastructure/) › Trumps: structural hazards
Ten structural hazards of essential services as a whole. Both decks carry them, ranked 1 (highest) to 10. The Trumps are carried by both decks. They rank 1 (highest) to 10. This page is part of the [Critical Infrastructure (Cyberwarfare) Threat Taxonomy](https://ostering.com/taxonomies/critical-infrastructure/), the reference for the Black Start card game.
## Mappings at a glance
STRIDE, CAPEC 3.9, CWE 5.0, ATT&CK for ICS v20.0, the Cyber-Informed Engineering principles (main one first) and standards, entry by entry. The same mappings are in each entry below and in the [Excel, SKOS and STIX downloads](https://ostering.com/taxonomies/critical-infrastructure/#downloads).
## Entries
BKS-TR-1 · One console, a thousand sites †
Central platforms let one operator or vendor change settings across every site at once. That is their purpose, and it means a single compromised account or session can do to a thousand stores, pump stations or chargers what used to take a thousand intrusions.
*Case:* Supermarket refrigeration attacks, 2026; Kaseya VSA and Coop Sweden, 2021.
**Principle.** The reach of any account, session or command is limited, and fleet-wide actions need more than one person.
**Design measures.**
1. Limit how many sites a command or account can affect, and require a second approval above that limit.
2. Let each site reject commands outside its safe envelope, whatever their source.
3. Alert in real time on bulk changes and on changes at unusual hours.
*Mappings:* STRIDE T, E · [CAPEC-122](https://capec.mitre.org/data/definitions/122.html) · [CWE-1220](https://cwe.mitre.org/data/definitions/1220.html) · ATT&CK for ICS [T0836](https://attack.mitre.org/techniques/T0836/), [T0859](https://attack.mitre.org/techniques/T0859/) · CIE 1, 4, 2
BKS-TR-2 · Vendor monoculture
Whole sectors buy the same controllers, firmware and management software from a handful of vendors. One flaw, one stolen vendor key or one compromised update reaches every operator at once, and they all need the same scarce vendor to recover.
*Case:* Danish energy sector, 2023; Viasat KA-SAT modems, 2022.
**Principle.** Critical functions do not all fail from one product, one vendor or one key.
**Design measures.**
1. Know which vendors and product versions your critical functions depend on, and which other operators share them.
2. Where consequence is high, use diverse products or an independent safety layer from another supplier.
3. Agree in contracts how the vendor will support many customers in a simultaneous incident.
*Mappings:* STRIDE D · [CAPEC-186](https://capec.mitre.org/data/definitions/186.html) · [CWE-1357](https://cwe.mitre.org/data/definitions/1357.html), [CWE-1395](https://cwe.mitre.org/data/definitions/1395.html) · ATT&CK for ICS [T0862](https://attack.mitre.org/techniques/T0862/) · CIE 9, 8, 7
BKS-TR-3 · The adversary has time
A state adversary can wait years inside networks, learning the process and choosing the moment. Defences built to stop quick criminal attacks, and detection tuned for noisy intrusions, miss quiet access that does nothing until it is ordered to.
*Case:* Volt Typhoon pre-positioning, 2024 advisory.
**Principle.** The design assumes access may already exist and limits what dormant access can do when activated.
**Design measures.**
1. Hunt for persistent access in edge devices, accounts and engineering systems, not only for malware.
2. Require fresh authorisation for dangerous actions so stolen standing access is not enough.
3. Keep logs long enough to look back over years, stored where an intruder cannot delete them.
*Mappings:* STRIDE S, E · [CWE-778](https://cwe.mitre.org/data/definitions/778.html) · ATT&CK for ICS [T0859](https://attack.mitre.org/techniques/T0859/), [T0883](https://attack.mitre.org/techniques/T0883/) · CIE 6, 5
BKS-TR-4 · Every feature is dual-use †
Defrost cycles, flushing, test modes, firmware update modes, remote shutdown and bulk configuration exist for good reasons. Each one is also a ready-made attack: the adversary needs no exploit, only the authority to use the feature at the wrong time.
*Case:* Supermarket refrigeration attacks, 2026; Ukraine grid attack, 2015.
**Principle.** Features that can cause harm are bounded by physics and design, not only by who is allowed to press the button.
**Design measures.**
1. List the built-in functions that could cause damage if used maliciously, and their worst case.
2. Bound those functions with interlocks, duration limits and local conditions that cannot be overridden remotely.
3. Remove or disable functions the operation does not need.
*Mappings:* STRIDE T, E · [CAPEC-554](https://capec.mitre.org/data/definitions/554.html) · [CWE-749](https://cwe.mitre.org/data/definitions/749.html), [CWE-912](https://cwe.mitre.org/data/definitions/912.html) · ATT&CK for ICS [T0831](https://attack.mitre.org/techniques/T0831/), [T0858](https://attack.mitre.org/techniques/T0858/), [T0800](https://attack.mitre.org/techniques/T0800/) · CIE 4, 2, 1
BKS-TR-5 · Safety cases assume accidents †
Safety engineering assumes faults are random and independent. An adversary is neither: they defeat the alarm, the trip and the backup together, and choose the moment when people are exposed.
*Case:* TRITON safety system attack, 2017.
**Principle.** Safety cases consider deliberate, coordinated action against the safety functions themselves.
**Design measures.**
1. Review hazard analyses asking what happens if an intelligent adversary triggers several failures at once.
2. Keep the last line of protection mechanical or hard-wired where the consequence is loss of life.
3. Separate safety systems from control systems so one compromise cannot reach both.
*Mappings:* STRIDE T, D · [CWE-636](https://cwe.mitre.org/data/definitions/636.html) · ATT&CK for ICS [T0880](https://attack.mitre.org/techniques/T0880/), [T0837](https://attack.mitre.org/techniques/T0837/) · CIE 1, 2, 5
BKS-TR-6 · Everything runs on power and comms †
Every essential service needs electricity and communications, and most have only hours of backup for either. An attack on power or telecoms is an attack on water, food, fuel and health care too.
*Case:* Viasat KA-SAT modems, 2022.
**Principle.** Each critical function's dependence on power and communications is known, backed up and tested for long outages.
**Design measures.**
1. Record how long each critical function lasts without grid power and without public telecoms.
2. Back the most critical functions with independent power and communications.
3. Test backups for the duration a deliberate outage could last, not only for minutes.
*Mappings:* STRIDE D · ATT&CK for ICS [T0826](https://attack.mitre.org/techniques/T0826/) · CIE 7, 10
BKS-TR-7 · IT and OT share a fate
Plants that never connected their controls to the internet still depend on billing, scheduling, directories and email. When corporate IT falls, operators often shut the physical process down too, because they cannot see, bill or trust it.
*Case:* Colonial Pipeline, 2021; NotPetya, 2017; JBS meat plants, 2021.
**Principle.** Physical operations can run safely for a planned time with corporate IT unavailable.
**Design measures.**
1. List which IT services operations need, and plan how to run without each one.
2. Keep separate directories and accounts for operational systems.
3. Exercise running operations for days with corporate IT disconnected.
*Mappings:* STRIDE D · ATT&CK for ICS [T0828](https://attack.mitre.org/techniques/T0828/), [T0826](https://attack.mitre.org/techniques/T0826/) · CIE 3, 10, 7
BKS-TR-8 · The plant outlives its software
Controllers, drives and substations are built to run for twenty to forty years, far longer than their software is supported. Known flaws stay in service for decades because patching means downtime, recertification or replacement.
*Case:* Ukraine grid attack, 2015.
**Principle.** Systems are designed to stay defensible after their vendor stops supporting them.
**Design measures.**
1. Plan lifecycle and replacement funding for control equipment from the start.
2. Put compensating controls around unsupported devices: isolation, allow-listing and monitoring.
3. Prefer products whose firmware can be updated without replacing hardware.
*Mappings:* STRIDE T, E · [CAPEC-682](https://capec.mitre.org/data/definitions/682.html) · [CWE-1329](https://cwe.mitre.org/data/definitions/1329.html), [CWE-1277](https://cwe.mitre.org/data/definitions/1277.html), [CWE-1104](https://cwe.mitre.org/data/definitions/1104.html) · ATT&CK for ICS [T0819](https://attack.mitre.org/techniques/T0819/), [T0866](https://attack.mitre.org/techniques/T0866/) · CIE 8, 5
BKS-TR-9 · Nobody can run it by hand †
Automation has replaced the people, procedures and equipment needed to run the process manually. When control systems are lost or cannot be trusted, there is no one left who knows how, and no gauges or valves to do it with.
*Case:* Norsk Hydro, 2019; Ukraine grid attack, 2015.
**Principle.** Critical functions can be run manually for long enough to recover, by people who have practised it.
**Design measures.**
1. Keep local instruments and manual controls for critical functions, and maintain them.
2. Write manual operating procedures and practise them on a schedule.
3. Keep experienced staff involved in training, and record what they know.
*Mappings:* STRIDE D · ATT&CK for ICS [T0827](https://attack.mitre.org/techniques/T0827/), [T0829](https://attack.mitre.org/techniques/T0829/) · CIE 10, 12
BKS-TR-10 · Planned for crime, not war
Incident plans, insurance and contracts assume criminals after money: pay or restore, and claim on the policy. A state adversary is after effect, won't negotiate, may strike many operators at once, and insurers may refuse payment as an act of war.
*Case:* NotPetya, 2017.
**Principle.** Plans are tested against an adversary who wants disruption and is not after money.
**Design measures.**
1. Add scenarios where no ransom is possible and several sectors are hit at once.
2. Check whether insurance and contracts exclude state or war-like attacks, and plan for that gap.
3. Agree in advance with authorities who decides, and how, when attribution is uncertain.
*Mappings:* STRIDE D · CIE 12, 10
## Public cases cited in this suit
- **Supermarket refrigeration attacks, 2026.** Overnight on 11 to 12 October 2026 attackers forced the remote-managed refrigeration controllers of hundreds of French supermarkets into defrost, heating cabinets to as much as 50C; stock was destroyed and some equipment caught fire. CERT-FR told operators to disconnect the controllers or tightly filter access to them. A second wave on 2 November hit supermarkets and food businesses in Sweden, Belgium, Ireland, Luxembourg, Estonia and Italy, and five Danish companies, where the attacks were stopped quickly. Danfoss confirmed its products were involved, and France's cyber agency judged the campaign probably still under way. *Attribution:* Unattributed at time of writing; Paris prosecutor's investigation open. *Sources:* [The Hacker News: attackers heat French supermarket fridges](https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html); [BleepingComputer: cyberattack shuts down refrigerators at French supermarkets](https://bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets); [DR: what we know about the attacks on European supermarkets](https://www.dr.dk/nyheder/udland/det-ved-vi-om-hackerangreb-paa-europaeiske-supermarkeder); [Today.it: attacks on refrigeration in Italy, ACN alert](https://www.today.it/attualita/attacchi-hacker-frigoriferi-supermercati-italia-allarme-acn.html)
- **Kaseya VSA and Coop Sweden, 2021.** In July 2021 ransomware was pushed through Kaseya VSA, a remote management tool used by managed service providers; Coop Sweden's tills stopped working and it closed about 800 stores for several days. *Attribution:* Attributed by the FBI to the REvil ransomware group. *Sources:* [The Record: Coop closes 800 stores after Kaseya ransomware attack](https://therecord.media/supermarket-chain-coop-closes-800-stores-following-kaseya-ransomware-attack/); [Truesec: Coop restored within 6 days](https://www.truesec.com/hub/blog/back-in-business-after-the-largest-ransomware-attack-of-all-time)
- **Danish energy sector, 2023.** In May 2023 attackers compromised 22 Danish energy companies in coordinated waves through flaws in the firewalls that protected them, the largest such attack Denmark had seen. *Attribution:* Unattributed; SektorCERT saw indicators linked to Sandworm in at least one attack, which other researchers later questioned. *Sources:* [SecurityWeek: 22 energy firms hacked in Denmark](https://www.securityweek.com/22-energy-firms-hacked-in-largest-coordinated-attack-on-denmarks-critical-infrastructure/); [SecurityWeek: Russian hackers likely not involved](https://www.securityweek.com/russian-hackers-likely-not-involved-in-attacks-on-denmarks-critical-infrastructure/amp/)
- **Viasat KA-SAT modems, 2022.** As Russia invaded Ukraine on 24 February 2022, the AcidRain wiper bricked tens of thousands of KA-SAT satellite modems across Europe; about 5,800 Enercon wind turbines in Germany lost remote monitoring and control, and many modems had to be replaced. *Attribution:* Attributed by the EU, UK and US governments (May 2022) to Russia. *Sources:* [DatacenterDynamics: satellite outage impacts more than 5,000 wind turbines](https://www.datacenterdynamics.com/en/news/satellite-outage-impacts-more-than-5000-wind-turbines-across-europe/); [energate: Enercon, thousands of wind turbines need new hardware](https://www.energate-messenger.com/news/220914/enercon-thousands-of-wind-turbines-need-new-hardware)
- **Volt Typhoon pre-positioning, 2024 advisory.** A February 2024 joint advisory found PRC state-sponsored actors inside the IT networks of US communications, energy, transport and water organisations, holding access, in some cases for at least five years, to disrupt operational technology in a crisis or conflict. *Attribution:* Attributed by CISA, NSA and FBI to PRC state-sponsored actors. *Sources:* [CISA advisory AA24-038A](https://cisa.gov/news-events/cybersecurity-advisories/aa24-038a)
- **Ukraine grid attack, 2015.** On 23 December 2015 attackers used three Ukrainian distribution companies' own control systems to open breakers, cutting power to about 225,000 customers. They also overwrote firmware on serial-to-Ethernet converters, wiped systems with KillDisk, tampered with backup power and flooded call centres with calls. *Attribution:* Attributed by the US Department of Justice (2020 indictment) to Russia's GRU Unit 74455 (Sandworm). *Sources:* [CISA ICS alert IR-ALERT-H-16-056-01](https://cisa.gov/news-events/ics-alerts/ir-alert-h-16-056-01); [MITRE ATT&CK campaign C0028](https://attack.mitre.org/campaigns/C0028)
- **TRITON safety system attack, 2017.** In 2017 malware reprogrammed Triconex safety instrumented systems at a Saudi petrochemical plant; it was found after the safety controllers tripped and shut the plant down. *Attribution:* Attributed by the US Treasury (2020 sanctions) to Russia's Central Scientific Research Institute of Chemistry and Mechanics. *Sources:* [MIT Technology Review: Triton](https://www.technologyreview.com/2019/03/05/103328/cybersecurity-critical-infrastructure-triton-malware/); [E&E News: The inside story of the world's most dangerous malware](https://www.eenews.net/articles/the-inside-story-of-the-worlds-most-dangerous-malware/)
- **Colonial Pipeline, 2021.** In May 2021 ransomware on Colonial Pipeline's business IT led the company to shut down the pipeline, which carries about 45 per cent of the US East Coast's fuel, for five days; shortages and panic buying followed. *Attribution:* Attributed by the FBI to the DarkSide ransomware group. *Sources:* [CBS News: Colonial Pipeline paid ransom](https://www.cbsnews.com/amp/news/colonial-pipeline-paid-hackers-randomware); [The Chemical Engineer: Major US pipeline restarts](https://www.thechemicalengineer.com/news/major-us-pipeline-restarts-following-cyber-attack-mag/)
- **NotPetya, 2017.** In June 2017 NotPetya, destructive malware disguised as ransomware, spread from a Ukrainian accounting software update. Maersk rebuilt its network and recovered its directory from a domain controller in Ghana that had been offline during a power cut; Mondelez's insurer cited a war exclusion, a dispute settled in 2022. *Attribution:* Attributed by the UK and US governments (2018) to the Russian military. *Sources:* [Redmond: the domain controller nightmare](https://redmondmag.com/blogs/scott-bekker/2018/08/domain-controller-nightmare.aspx); [The Record: Mondelez and Zurich reach settlement](https://therecord.media/mondelez-and-zurich-reach-settlement-in-notpetya-cyberattack-insurance-suit)
- **JBS meat plants, 2021.** In June 2021 ransomware halted JBS meat processing plants in the US, Canada and Australia for several days; the company paid a ransom of about 11 million dollars. *Attribution:* Attributed by the FBI to the REvil ransomware group. *Sources:* [NPR: REvil behind JBS cyberattack, FBI says](https://www.npr.org/2021/06/03/1002819883/revil-a-notorious-ransomware-gang-was-behind-jbs-cyberattack-the-fbi-says)
- **Norsk Hydro, 2019.** In March 2019 LockerGoga ransomware hit the aluminium maker Norsk Hydro; plants switched to manual operation while systems were rebuilt. *Attribution:* Criminal ransomware; no state attribution. *Sources:* [Fortune: Norsk Hydro cyber attack](https://fortune.com/2019/03/19/norsk-hydro-cyber-attack)
---
*© 2026 Jonathan Brett Crawley. Licensed under [CC BY-NC-ND 4.0](https://creativecommons.org/licenses/by-nc-nd/4.0/) with additional permissions: see the licence on the [overview](https://ostering.com/taxonomies/critical-infrastructure/#licence). † marks a physical-safety consequence.*